Threats tagged 'ghsa-m6gm-cm8g-r2qc'

deeptutor version 1.4.0 has an authorization bypass vulnerability in the TurnRuntimeManager.regenerate_last_turn function. This flaw allows a remote attacker with limited privileges to enumerate or obtain another user's session_id and invoke the regenerate function on that session. The vulnerability does not impact confidentiality or availability but can lead to unauthorized modification of session state.